Germany Lets Apple Keep ATT and Takes the Scare Off

Germany’s cartel office has locked Apple into a seven-year rewrite of App Tracking Transparency prompts, without taking the tracking wall down. The Bundeskartellamt declared Apple’s ATT commitments binding on 17 August 2026, after a decision dated 13 August in case B7-54/25.

Apple has four months from service of that decision to ship the new screens on iOS and iPadOS, then live with an independent monitoring trustee for seven years from the day they go live. ATT itself stays.

Germany Closed the Case and Left ATT Standing

The office opened the file in June 2022. It sent Apple a preliminary legal assessment on 13 February 2025, ran a market test of offered fixes on 2 December 2025, and then took a tighter package rather than a prohibition order. Apple still says the rules comply with competition law. It offered the commitments anyway.

Andreas Mundt, president of the Bundeskartellamt, drew the line the authority actually cares about. Privacy above the legal minimum is allowed. Extra rules Apple writes for its own software may not treat Apple’s apps and ads better than everyone else’s. That dual role is the whole case. Apple runs iOS, iPadOS and the App Store, and it also sells apps, services and ad space. In the designation file, up to 60 per cent of app publishers’ turnover runs across that infrastructure.

Apple designated under Section 19a of the German Competition Act in April 2023, a label the Federal Court of Justice confirmed in March 2025. The ATT file also sits on Article 102 of the EU treaty. The German data protection bodies that spoke to the cartel office like ATT as policy. They also said it is not required under data protection law. The proceeding was never a privacy case. It was a self-preferencing case that used a privacy screen as the lever.

The Warning Hand Comes off the Prompt

Third-party apps that want the Identifier for Advertisers, the IDFA, still have to show Apple’s system prompt. What changes is the chrome. The warning hand goes. So does the word “tracking,” which publishers told the office sounded like an alarm. Button labels and the order of choices move closer to Apple’s own Personalized Ads prompt. In Germany, only the new ATT screen and the adjusted Apple screen will be shown.

Publishers also get room to talk. The FAQ attached to the decision gives them a customizable purpose string of 4,000 characters, against Apple’s old guidance of about one or two sentences. They can add a text button and a second page for extra detail or finer switches.

OLD ATT, APPLE’S OWN ASK, AND THE NEW DEAL

The legal geography is narrow even if the software is not. The order covers users with an App Store billing address and a device located in Germany. Apple has said the same prompt changes will run in almost all other EU countries. Those are different facts. Bonn can bind Germany. Cupertino can choose to ship the build more widely.

Apple Still Uses a Softer Ask for Its Own Ads

Apple does not need the IDFA for its own personalised ads. It uses data from accounts, the App Store and other first-party pipes, then shows the Personalized Ads prompt. It does not add a separate consent-management screen on top. Third-party apps usually do both: a GDPR consent-management platform, then Apple’s ATT prompt for the same advertising purpose. Users saw two asks. Apple’s ads stack saw one.

The cartel office also recorded a money incentive that rarely makes the privacy speeches. On paid apps and subscriptions, Apple often takes a commission. On a publisher’s advertising revenue, it generally takes nothing. A rule that makes third-party ads harder to measure, while Apple’s own ads keep a clean identifier, is not a side effect in that light. It is a traffic plan.

Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent to such data use.

Andreas Mundt, President, Bundeskartellamt

An Apple spokesperson kept the privacy line and treated the redesign as formatting. The company said it still believes the current ATT prompt is a clear way to keep users in control of their data, a view it said German data protection authorities share, and that it agreed to change the text and formatting at the cartel office’s request. It also said the commitments let it keep the privacy tool in Europe.

The complainants were not privacy groups. They were German media and advertising associations that filed in 2021: BDZV, Die Mediaagenturen, Markenverband, MVFP, VAUNET and ZAW. They wanted the extra-statutory rules gone, not restyled. They did not get that.

€150 Million in France, Then €98.6 Million in Italy

Bonn’s file is the first binding Section 19a measure against Apple. It is not the first European ATT fight. The French and Italian authorities already issued fines. They did not accept a redesign in place of a penalty. Mundt’s office, working inside the European Competition Network, aimed at how the screens will look from here.

THE ATT CLOCK IN EUROPE

1. 26 April 2021: Apple turns on App Tracking Transparency with iOS 14.5 and iPadOS 14.5.
2. June 2022: The Bundeskartellamt opens its ATT proceeding.
3. April 2023: Apple is designated as being of paramount significance for competition across markets under Section 19a.
4. 31 March 2025: France’s Autorité de la concurrence fined Apple €150 million over ATT for the period from April 2021 to July 2023.
5. 22 December 2025: Italy’s AGCM imposed a €98.6 million ATT fine for abuse of a dominant position on the App Store.
6. 13 August 2026: Germany issues the commitment decision in case B7-54/25.
7. 17 August 2026: The proceeding is closed; Apple has four months from service to implement.

France found that ATT’s aim was not the problem and that the way it was built was neither necessary nor proportionate. Multiple pop-ups made third-party apps harder to use, and the interaction between those windows undercut neutrality. Italy put the same double-ask at the centre. The AGCM said the ATT prompt does not meet privacy-law requirements, so developers had to ask twice for one purpose, and that Apple should have allowed a single step.

A Paris court in January 2026 refused to suspend ATT while France’s fine is fought. That left the prompt running in France even after the penalty. Germany’s deal is the first one that actually rewrites the screen.

Why Opt-In Rates May Barely Move

The scare language was real. So is the floor it sat on. Kochava Foundry’s mid-2026 attribution mix is the cleaner picture of what ATT already did to measurement, and it will not reset because a hand icon disappears.

WHAT KOCHAVA SEES ON iOS IN 2026

• When the prompt appears: 69.7% of users who are shown an ATT dialog accept it, up from about 37% at launch and past 50% in September 2024.
• How often it appears: Only 2% of iOS installs are prompted at all. In Kochava’s marketer survey, 24% of respondents had not implemented an ATT prompt.
• Where credit goes: Before iOS 14.5, the IDFA was 42% of iOS attributions. As of mid-2026, about 10% of attributions are device-level and consented, SKAdNetwork is 11%, and Apple Ads at 36% of iOS attribution volume.
• Who feels sure: Only 21% of iOS app marketers in that survey call themselves confident in iOS attribution. Thirty-three per cent have not implemented SKAdNetwork.

Grant Simmons, vice president of Kochava Foundry, has been pointing at the gap between those two consent numbers. People who see the dialog mostly tap allow. Most apps never show it. A friendlier system prompt helps the first group. It does nothing for the installs that never get asked, and it does not revive IDFA matches that need both the advertising app and the advertised app to have consent.

Apple Ads did not need that double yes. It still has a deterministic keyword-to-device link without an ATT opt-in. That is why spend concentrated there after 2021, and why a German UX change does not, on its own, unwind the measurement advantage. Eric Seufert, the mobile analyst, wrote that bundling other consent requests with ATT will nudge European opt-in rates up by a non-trivial amount, and that he expects other European probes to land in a similar place. He also said he does not see the United States copying the design, and that past “Ask App Not to Track” choices will not reverse in a wave. The economic jolt, on that reading, stays limited. The precedent is the part that travels.

A Seven-Year Monitor and a Copybook Other Capitals Can Use

Before the new screens ship, Apple has to run technical tests with publishers, the Beta Seed Testing named in the FAQ. After they ship, the commitments run seven years. The trustee watches Apple, mediates fights with publishers, and files regular reports in Bonn. A publisher that thinks Apple is breaching the deal can go to the trustee. If mediation fails, the trustee takes it to the cartel office. The office keeps its own enforcement powers.

The architecture change is the piece publishers can actually use. Where GDPR consent and ATT overlap, they get three defined paths.

THREE WAYS TO COMBINE THE ASKS

• One combined screen: Put the legally required GDPR information in the 4,000-character string and the extra detail behind the text button, so one allow or refuse covers both ATT and the consent-management platform, including first-party data used for ads, if every privacy-law box is ticked.
• Two screens, with a cross-reference: Keep the existing consent-management platform, then mention that prior yes inside the new ATT prompt. If the user already refused the GDPR ask, the publisher may not show ATT or use the IDFA. If the user said yes, the publisher may show ATT again 12 months after the last display.
• Two screens, as before: Keep them fully separate. The publisher still gets the new ATT wording and layout, and does not have to use the new combination tools.

Dr. Bernd Nauen, director general of ZAW, called the abuse finding a win and the remedy too soft. The associations still say a gatekeeper should not write extra-statutory data rules at all. They also say many publishers will still show two asks, and that the office did not stop Apple processing some data with no extra user yes. Nauen said the finding is a basis for civil damages claims over losses since ATT launched. A UK damages action citing the same prompt design was filed in early September 2026, after the German announcement. The German deal itself pays no one for 2021 to 2026. It only rewrites the screen going forward.

Poland and Romania still have their own ATT files. The Digital Markets Act does not block this national case; the FAQ is explicit that DMA enforcement in Brussels leaves Article 102 and Section 19a work intact. That is why the German package is already being treated as a template other European capitals can copy, even though the order’s hard edge is a German billing address and a German device.

Frequently Asked Questions

Do the New ATT Prompts Apply on iPad as Well as iPhone?

Yes. Apple must put the changes into both iOS and iPadOS and tell app publishers before they go live, after Beta Seed Testing with those publishers. The German order still turns on the user’s App Store billing address and the device’s location, so an iPad signed into a German-billed account is in scope in the same way as an iPhone.

Will Apple Re-Ask Users Who Already Tapped Ask App Not to Track?

The commitments do not reset historical ATT refusals in a mass sweep. A publisher that uses the second path may show the new ATT prompt again 12 months after the last display, and only to users who already gave the overlapping GDPR consent. Everyone else keeps the choice they already made unless a publisher has a lawful new reason to ask.

Is This a Digital Markets Act Case?

No. The Bundeskartellamt built the file on Section 19a of the German Competition Act and on Article 102 TFEU. The DMA is enforced by the European Commission against designated gatekeepers for listed core platform services. The German FAQ states that the DMA leaves those national and European abuse rules in place, which is how Bonn could close ATT with commitments while DMA fights over App Store terms run on a separate track.

Who Can a Publisher Call if Apple Misses the New Prompt Rules?

Publishers can go to the independent monitoring trustee, who works for the Bundeskartellamt, tries to settle the dispute, and reports in. If the trustee cannot close it, the trustee informs and consults the cartel office. The office’s ordinary powers to enforce the commitments stay in force for the full seven years after implementation.

The trustee’s clock starts when the new prompts ship, not on 13 August 2026. Publishers who think the Beta Seed build still steers users off their ads will have a named person to call for seven years after that ship date. The tracking permission will still sit behind Apple’s system dialog. The hand icon will not.